Ad tech legal checkpoints: 10 questions to take to your counsel before you launch

Each page begins with the rule text. The source link leads to a specific section, paragraph or court document. Where a law has several tests, the page separates them. An exception for one step may answer a different question from the rule for a later step.

Next come the readings. They describe how people can apply the same words to a particular flow and where their interpretations diverge. We give them equal space in neutral order. A reading that fits one example may depend on a premise missing in another.

The third part is the fact list. Some facts come from an agreement or a notice, while others come from logs and requests. For example, a contract might name a recipient without listing all the fields that it sees. An engineer can trace the fields without deciding which legal role applies.

The fourth part is the list of questions for counsel. Each question points to a decision, a document or a gap in the facts. The fifth part compares design options by what they give the business, what remains open and how much work a reversal would take.

A full card in a reference page gives the question, why it is open and three prompts to discuss. A shorter link appears when another reference touches the same question. Both link to the same full checkpoint, where the longer question list is available as a download.

The library separates three kinds of statements. A rule can state a test, a court or regulator can describe its application on a given record, and practitioners can describe a design used in the field. Those statements have different sources. A company description can show what that company says about its product, while a court order can show what the court decided.

The table starts with health data and permissions, then turns to litigation, finance and advertising signals. The group reflects the main issue on each page. One flow can still involve several groups. The last column shows where the question is marked in a longer reference.

A person starting with a health campaign may reach the question about de-identification while reviewing who can receive an audience. The tracking question can arise earlier, when a visitor first opens a page. In the financial examples, the questions can arise in merchant reporting and in the service that makes a match.

The jurisdiction chips show which rules the checkpoint discusses. They do not identify the laws that govern a specific campaign. A single program can have recipients in one country and people whose data is used in another. The fact list can capture both.

1. Map the flow by step. Identify where data enters, where it is stored, which fields move and who receives them.
2. Pick the checkpoints the flow touches. A single request can raise issues about data type, permissions, recipient use and jurisdiction.
3. Fill in the fact sheet in the counsel briefing kit. Separate actual captures, contract terms and the team’s assumptions.
4. Send the fact sheet and selected questions to counsel using the arrangement for your organization. Put the decisions that need an answer beside the evidence.
5. Record the reading adopted, why it fits the assumed facts, who decided and when to look again.

An example starts with a proposed promotion on a health site. One person can map the tag and its timing, while another identifies which vendor can use the data. The legal question then concerns the recipient’s function, the information sent and the applicable rules. The records let counsel assess a specific flow.

Another example starts with a financial institution’s merchant offer. The report sent to the merchant can differ from the file sent to a vendor for matching. The fact sheet can separate the two operations, and the question list can ask which disclosure route fits each recipient.

A decision record is easier to revisit when it says what evidence was considered. A new vendor may change the list of recipients without changing the creative or the buying goal. A revised request may add a key even though the page looks the same to a visitor. Those changes can be recorded as triggers for another look.

A useful distinction in the fact sheet is the difference between a service name and a data recipient. The business may buy a single service from a vendor, while the request goes to a separate company named only in an integration document. Naming the endpoint and its operator gives counsel a more precise question.

The same applies to decisions about reporting. A business can describe a campaign report as a total and still send its vendor rows that are used to compute that total. The source of a report and its final output may both matter. The checkpoint table helps separate questions about each stage.

The same question can appear in several reference pages because each page describes a different part of the flow. The checkpoint ID stays the same across those pages.

The answer can depend on facts the publisher cannot see. The words in a private contract, the exact payload and the moment a tag fired can all matter. The question list helps a team surface that evidence to counsel.

Rules also differ by state and country and can change during the year. The current text, the date of an order and the stage of an appeal answer different questions. A date beside a source tells readers when it was checked.

The choice between readings belongs to the business and its counsel. Management can weigh the value of a program, the uncertainty it accepts and the time needed to change it. The same design choice can make sense to one organization and have different costs for another.

A court’s decision can also have a narrow record. A court may resolve a preliminary motion without deciding the underlying claims, or rule on a statute that differs from the one relevant elsewhere. The checkpoint links to the source so counsel can compare its scope with the question presented.

Related references

• counsel briefing kit
• ad tech compliance guide
• identity and privacy guide
• commerce media guide

1. 45 CFR 160.103, business associate definition. Checked 10 November 2026.
2. 45 CFR 164.514(b)(1)–(2). Checked 10 November 2026.
3. Maryland Commercial Law § 14-4707(a)(1)–(2). Checked 10 November 2026.
4. 18 U.S.C. § 2511(2)(d). Checked 10 November 2026.
5. 12 CFR 1016.10(a). Checked 10 November 2026.
6. ePrivacy Directive Article 5(3). Checked 10 November 2026.
7. 12 CFR 1016.13, service provider and joint marketing exception. Checked 10 November 2026.
8. GDPR Articles 4, 6 and 9, definitions and processing conditions. Checked 10 November 2026.
9. Court of Justice, IAB Europe, C-604/22, paras. 42–51 and 58–77. Checked 10 November 2026.